Which ISMS documentation is part of the minimum scope of documented information required to be managed and controlled?

ISO/IEC 27001 explicitly requires organizations to retain documented information as evidence of the results of management reviews (Clause 9.3.3). A key output of these reviews includes decisions and actions related to continual improvement opportunities. Furthermore, Clause 10.2 (Continual improvement) mandates retaining documented information on the nature of nonconformities and the results of any corrective actions taken. Management decisions are integral to both processes. Therefore, records of these decisions are a required part of the ISMS documentation, serving as evidence that the continual improvement cycle is being managed and controlled.

B. The standard requires security awareness (Clause 7.3), but does not mandate that specific third-party awareness materials must be retained as documented information.

C. While the organization must provide resources (Clause 7.1), the standard does not explicitly require the budget itself to be maintained as mandatory documented information.

D. A statement of correspondence with other standards is not a requirement of ISO/IEC 27001. It may be useful for integrated systems but is not mandatory.

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Clause 9.3.3, Management review results: "The organization shall retain documented information as evidence of the results of management reviews." The outputs specified in this clause include "decisions and actions related to continual improvement opportunities".

Clause 10.2, Continual improvement: "When a nonconformity occurs, the organization shall... retain documented information as evidence of: a) the nature of the nonconformities and any subsequent actions taken; b) the results of any corrective action."

2. von Solms, R., & von Solms, B. (2018). "Information Security Governance." In Cybersecurity and Privacy in Cyber Physical Systems (pp. 25-42). Springer, Cham.

In discussing the implementation of ISO 27001, the authors highlight that evidence of management review and corrective actions are critical documented components for demonstrating governance and continual improvement, aligning with clauses 9.3 and 10.2. This underscores that records of decisions are not optional but a required artifact. (DOI: https://doi.org/10.1007/978-3-319-68320-92)